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1 .0 PREFACE 


This document is a compilation of hazard descriptions which 
have been identified in the manned space flight programs, 
including Mercury, Gemini, Apollo, Skylab, and the Apollo/ 

Soyuz Test Project. This summary is intended to provide an 
element of experience retention in the identification of 
hazards. In order to keep the catalog as simple and concise 
as possible, each listing is limited to material descriptive 
of the hazard or necessary to understand its nature. No 
attempts have been made to discuss possible methods of 
avoidance, to assess the degree of risk involved in available 
alternatives, or to identify the specific program involved. 

Such information will be made available upon request to the 
JSC Safety Division, mail code NS. Recipients are encouraged 
to forward to the same address suggested additions to the 
catalog. 

This issue of this catalog constitutes a complete revision to 
previously published editions, including a revision of format, 
and an increase of approximately 30 percent in the number of 
enteries. Therefore, no attempt has been made to indicate 
specific areas that have been altered or added. 

Addressees are requested to forward this catalog to those 
persons having an interest in the design, fabrication, checkout 
or operation of spaceflight equipment. 
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2.0 INTRODUCTION 

2.1 GENERAL 

Man's first landing on the moon on July 20, 1969, marked 
the culmination of 10 years of intensive effort in learning 
how to design, build, and operate space vehicles. During 
this period, most of the significant hazards associated 
with space flight were identified and circumvented success- 
fully by the engineers directly involved in the on-going 
programs. This document is intended to increase awareness 
of the hazards that were identified during those early 
years of manned space flight and during the most recent 
Skylab and Apollo Soyuz programs. 

In the interest of brevity, each listing is limited to 
descriptive material necessary in understanding the nature 
of the hazard. 

2.2 PURPOSE 

This document provides current and future space program 
designers, managers, and analysts with a single reference 
listing of the most significant hazards identified on previous 
manned space flight programs. This summary is of special value 
to system safety engineers in developing safety checklists 
and otherwise tailoring safety tasks to specific systems and 
suosystems to provide assurance that "lessons-learned" from 
previous programs are retained. 
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3.0 HAZARDS CATALOG ORGANIZATION 


In this catalog, hazards are presented in nine major 
categories related to major spacecraft subsystems or to 
overall spacecraft operations (refer to Table I). These 
categories are further divided into 18 subcategories which 
relate to general problem areas such as toxicity, corrosion, 
vibration, etc. (refer to Table I). To minimize duplication, 
hazards are listed in the most appropriate category and sub- 
category. For example hazards pertaining in general to 
fluids and gases are listed in the "fluid" major category. 
They are then divided into the most appropriate subcategory 
for easy reference. 


TABLE I. - HAZARDS CATALOG CATEGORIES 


MAJOR CATEGORIES SUBCATEGORIES 


Environmental 
Structural 
Mechanical 
Electri cal 
Fluid 

Propulsion 

Explosive 

Aerodynamic 

Operational 


Configuration 

Fabrication 

Contamination 

Toxicity (including irritants) 

Flammability 

Corrosion 

Vibration 

Human error 

Improper procedures 

Defective or unsuitable equipment 

Verification of equipment 

Handling of equipment 

Protection from environment 

Operational status information 

Pressure control 

Leakage 

Overloads 

Transients 
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4.0 

ENVIRONMENTAL HAZARDS 

4.1 

CONFIGURATION 

4.1.1 

Failure of cabin pressure relief valve to relieve during 
launch and reentry phases of flight. 

4.1.2 

Inadequate provisions to prevent cabin ventilating fans 
from jamming caused by debris floating in zerogravity 
conditions. 

4.1.3 

Inadvertent switch actuation because of inadequate 
marking, inadequate guarding, improper spacing, or 
positioning on panels. 


The problem is accentuated during suited operations 
by the lack of a sense of feel with pressurized suits 
and gloves. 

4.1.4 

Inadequate provisions to keep overboard dump lines functional 
because of clogging or freeze-up. 

4.1.5 

Lack of moisture protection for sensitive equipment which is 
mounted near plumbing lines, cold plates, etc. 

4.1.6 

Sharp points or edges that could injure crewmen or tear 
pressure suits in the crew bay or during extravehicular 
activity. 

4.1.7 

Venting of the crew bay to space through the same opening 
used to vent liquids or harmful gases. 


The opening may freeze and prevent pressure relief 
of the crew bay. 

4.1.8 

Lack of screens to prevent entry of tools, hardware, or 
debris into sections of the spacecraft where interference 
with the operation of spacecraft equipment could result. 

4.1.9 

No isolation capability for multiple pressure suits on a 
common pressure source to ensure retention of a survivable 
environment in the remaining suits if one suit ruptures. 

4.1.10 

Lack of protection against actuation of equipment by 
involuntary movements of a sleeping crewman. 


This problem is accentuated in zerogravity by permitting 
arms and legs to float away from couches or seats. This 
problem is most critical in solo operations. 
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4.1.11 Cabin pressure relief valves that are sensitive to and 
unprotected from debris of the type that could reach them 
under zerogravity conditions. 

4.1.12 No provisions for an audible alarm warning to indicate 
low or rapidly decreasing spacecraft cabin pressure, 

4.1.13 No provisions to prevent water penetration in the crew cabin 
during water landing, 

4.1.14 Inadequate provisions to prevent the introduction of 
undesirable gases into the breathing gas supply systems. 

4.1.15 Switches and controls not protected from impact of heavy or 
rigid equipment that must be donned, worn, or moved about 
in the crew bay. 

4.1.16 Deployed equipment chilled below the cabin dew point not 
protected against condensation when reintroduced to the 
cabin environment. 

4.1.17 Deployed equipment heated above touch temperature limits 
not adequately protected from the crew and temperature 
sensitive equipment when reintroduced to the cabin 
environment. 

4.1.18 Inability to regulate cabin pressure remotely for each 
compartment of the spacecraft. 

4.1.19 Failure to provide a warning indication when the spacecraft 
habitable environment relief valve(s) and other venting 
devices are not fully seated. 

4.1.20 Lack of protection of the crew and equipment from the release 
of shattered material fragments. 

4.1.21 Location of exhaust ports in proximity to relief valves 
may allow gas ingestion on reentry, hazardous gases may be 
drawn into the crew bay along with the outside air, 

4.1.22 Expansion of closed cell foam materials due to pressure change 
when such materials are used as cushions, equipment stowage 
pads or spacers may produce undesired configuration changes. 

4.2 CONTAMINATION 

4.2.1 Spacecraft windows and optical surfaces obscured by 
outgassing materials, overboard dumps, or engine exhaust. 

4.2.2 The use of mercury inside the spacecraft habitable 
environment without suitable protection. 
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4.2.3 Inadequate means of decontaminating equipment and personnel 
exposed to radioactive materials. 

4.2.4 Improper sealing of pathogenic biological payloads. 

4.2.5 Lack of adequate protective covers for equipment containing 
lenses. 

4.2.6 Lack of caution and warning sensors f.r pathogenic biological 
equipment. 

4.2.7 Inadequate provisions for preventing release of radioactive 
materials in the event of an accident. 

4.2.8 Lack of radiation dosimeters for each crewman when pryloads 
or operational environments involve potentially high 
radiation sources. 

4.2.9 The use of radioactive materials for illuminating purposes 
without positive mechanical protection against abrasion, 
flaking, or direct crew contact. 

4.2.10 The use of nonlife supporting gas to purge habitable 
modules without provisions to assure adequate oxygen levels 
and gas mixing prior to crew entry. 

4.2.11 Use of drinking water not properly purified. 

4.2.12 Release of biocide such as potassium iodide/iodine solution 
into habitable areas of a spacecraft. 

4.2.13 The use of water genera i.i on/storage equipment susceptible 
to metallic ion contamination. 

4.2.14 Residuals from cleanina operations may react with lithiun’ 
chloride when circulated through carbon dioxide absorbent 
canisters producing toxic substances. 

4.2.15 Silicone rubber RTV (room temperature vulcanizing) compounds 
which release acetic acid during curing cause corrosion to 
incompatible materials, such as lead, brass, and solder 

4.2.16 Halogen acids released by hydrolysis of halogens (blowing 

or curing agents) in certain urethane foam thermal insulations 
or polyester paints may corrode metals to which they are 
applied. 
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4.2.17 Anaerobic thiead locking compounds (such as "loctite") used 

on screws which are removed or turned aTter the compounds have 
hardened may generate particulate contamination. This is due 
to the brittle, crumbly nature of the hardened compounds. 

4.2.18 Inadequate strength of packaging materials and package seals 
for food packages, operational supplies, etc., may allow 
bursting or leakage of contents as a result of cabin pressure 
changes. 

4.3 TOXICITY 

4.3.1 Entry of toxic fumes into spacecraft cabin during reentry. 

4.3.2 The use of shatterable or shreddable materials in the 
crew bay whose particles would be injurious to the crew. 

Includes use of paints or coatings that can flake. 

4.3.3 The use of paint or coatings which contain carbon black 
in the crew bay. 

Carbon black outgasses carbon monoxide which is not 
removed by present environmental control systems. 

4.3.4 The use of cadmium in the crew bay. 

Cadmium outgasses toxic fumes at low pressure or at 
elevated temperatures. 

4.3.5 Ethylene glycol, Coolanol, or other coolant fluid vapors 
in the cabin or suit atmosphere. 

In concentrations greater than 25 to 70 parts per 
million, these vapors produce intolerable throat, 
eye, and nose irritation requiring emergency action , 
e.g., use of oxygen masks and mission abort. 

4.3.6 Inadequate means of controlling the presence of an 
unacceptable toxic environment in the spacecraft - 

4.3.7 Lack of emergency previsions to ourge contaminants from 
spacecraft volumes or to provide emergency breathing 
capability. 
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4.3.8 Contamination of spacecraft breathing gas systems with 
mercury. 

The use of mercury in testing and calibrating valves, 
instruments, etc. can result in dangerous levels 
of toxic mercury vapor in spacecraft breathing gas 
systems. 

4.3.9 Contamination of packaged food or drinking water with 
mercury. 

4.3.10 Undetected buildup of carbon dioxide in cabin or suit 
circuit. 

4.3.11 The use of beryllium, beryllium oxides, or alloys containing 
more than 4 percent of beryllium inside the spacecraft 
habitable environment without suitable protection. 

4.4 FLAMMABILITY 

4.4.1 Inadequate control of flammable materials in oxygen rich 

envi ronments . 

4.4.2 Sparks generated by removal of containers, e.g., removal 
of lithium hydroxide canisters from their storage 
compartments in the crew bay. 

4.4.3 Static charges generated from suits and couches in the 
crew bay. 

4.4.4 Use of dichloroethane in spacecraft which utilize lithium 

hydroxide for carbon dioxide control. 

Dichloroethane mixed with lithium hydroxide can 
generate acetylene which is highly flammable in the 
spacecraft oxygen atmosphere. 

4.4.5 Improper provisions for the stowage of flammable, explosive 
or gas generating materials. 

4.4.6 Components capable of causing ignition used in areas with 
flammable vapors, liquids, or other combustible materials. 

4.4.7 Lack of adequate fire detection and control devices where 
required. 
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4.4.8 Inability of enclosure containing flammable materials to 

contain combustion to prevent propagation. 

4.5 PROTECTION FROM ENVIRONMENT 

4.5.1 Failure to provide ear protective devices in high noise 
environments. 

4.5.2 Exposure of crew members to high intensity light. 

4.5.3 Use of single pane spacecraft windows without positive 
assurance of pressure retention capability in case of 
failure. 

4.5.4 Lack of ultraviolet and infrared shielding on spacecraft 
viewing and photographic windows. 

4.5.5 Lack of proper crew protection for handling extremely hot or 
extremely cold equipment. 

Hardware which has been exposed to space environment 
for long periods of time nay be extremely hot or 
cold, depending upon whether the hardware was exposed 
to direct sunlight or in the shade of the spacecraft 
or other objects. 
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5.0 STRUCTURAL HAZARDS 

5.1 CONFIGURATION 

5.1.1 Inadequate or incorrect stress analysis. 

5.1.2 Improper venting of space vehicle interstage compartments 
and shrouds. 

5*1 *3 Structural crevices where debris can become lodged in a way 

that produces local stress concentrations in tank skins. 

5.1.4 Inadequate allowance for distortions and stresses resulting 

from the»tiial expansion or contraction. 

5.1.5 Vulnerability of crew bay floor to unrecognized damage under 
one gravity conditions because of weight of people and 
equipment or impact of dropped tools. 

5.1.6 Damage due to elastic recoil of vehicle structure under 
strain at time of holddown release. 

5.1.7 Inadequate venting of enclosures to protect against buildup 
of internal pressure from evaporation of trapped moisture 
or outgassing during aerodynamic heating. 

5.1.8 Damage due to elastic recoil resulting from abrupt engine 
shutdown. 

5.1.9 Puncture of tanks by projections on adjacent hardware, 
resulting from inadequate allowance for structural 
distortions. 

5.1.10 Inability of equipment and component containers within the 
habitable areas of the spacecraft to withstand decompression 
and recompression. 

5.1. 'll Vacuum vent plumbing inadequately protected from mechanical 
damage. 

5.1.12 Inadequate protection from pyrotechnic shock effects. 

5.1.13 Insecurely mounted equipment without sufficient margins for 
operational loads, including normal cr contingency landings. 

5.1.14 Excessive dynamic loads in flight due to longitudinal 
oscillations (P060) resulting from engine thrust variations. 
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5.2 

5.2.1 

5.2.2 

5.3 

5.3.1 

5.4 

5.4.1 

5.4.2 

5.4.3 

5.4.4 


FABRICATION 

Unsatisfactory bonding of skins on honeycomb structural 
elements. 

Hydrogen embrittlement of 4130 or 4340 steel heat-treated 
above 180 thousand pounds per square inch and preloaded 
in tension. 

FLAMMABILITY 

Lack of fire extinguishing agent access to isolated but 
unsealed containers, panels, or racks vdiere flammability 
hazards exist. 

CORROSION 

Galvanic corrosion of structure under lead-sheathed shaped 
charges. 

Use of metal couples that create unacceptable galvanic 
corrosion. 

Materials or components adjacent to fluid lines or containers 
which contain incompatible fluids. 

Stress corrosion resulting from: 

a. Overtorque or overload beyond stress corrosion limits. 

b. Exposure to environments not anticipated in design. 
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6.0 MECHANICAL HAZARDS 

6.1 CONFIGURATION 

6.1.1 Premature initiation of sequences by false signal of stage 

or module separation caused by: 

a. Separation sensors with inadequate travel triggered 
by structural deflections. 

b. Faulty system design allowing signal to be generated 
by malfunction of a single separation sensor. 

6.1.2 Lack of retention of the ends of springs to prevent jumping, 
jarring, or jainming which alters the spring force 
characteristics. 

6.1.3 Gyros and gyro mounting brackets that are not positively 
keyed to prevent interchanging gyros or installation of a 
gyru in an incorrect orientation. 

This same hazard exists in the case of accelerometers 
used in guidance systems. 

6.1.4 Lack of redundant means of accomplishing critical 
operation sequences, e.g., separation of reentry module 
from other modules or equipment that would prevent a safe 
reentry and landing. 

6.1.5 Lack of protection of nozzles and vents used in manned 
spacecraft systems from entrance of rain, debris, or other 
contaminants prior to launch. 

6.1.6 Improper shielding of rotating elements to prevent damage 
resulting from exploding fragments. 

6.1.7 The use of chains, beaded links, or similar segmented 
devices which can be broken, resulting in loose pieces 
floating in the spacecraft. 

6.1.8 Lack of tethering of locking pins, knobs, handles, protective 
caps, plugs, and similar devices which require removal during 
flight operation. 

6.1.9 Cargo handling mechanisms that cannot withstand the 
propulsive forces resulting from leaking or ruptured fluid 
cargoes . 
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6.1.10 Inadequate seal replacement provisions for airlocks and 
similar mechanical devices that penetrate the pressure 
shell of the habitable area of the spacecraft. 

6.2 HANDLING OF EQUIPMENT 

6.2.1 Lack of positive medianical locking devices for lifting 
devices and tiedowns. 

6.2.2 Lack of automatic braking or stop features on lifting 
mechanism cable drums. 
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7.0 ELECTRICAL HAZARDS 

7.1 CONFIGURATION 

7.1.1 Redundant paths not adequately separated. 

7.1.2 Failure to key electrical connectors to positively prevent 
interchanging with other accessible connectors. 

7.1.3 Metallic particles in electrical equipment generated by 
screw threads used to attach covers or connectors. 

7.1.4 Inadequate means of protecting electrical equipment from 

effects of particles or parts floating in zerogravity 
environments. 

7.1.5 Failure of the fuel cell separation system to separate 
completely the hydrogen gas from the potable water. 

7.1.6 Inability to checkout pyrotechnic circuits after installation. 

7.1.7 Inadequate isolation of pyrotechnic wiring from other 
spacecraft wiring. 

7.1.8 Sharp edges that can contact unprotected electrical wire 
insulation. 

7.1.9 Condensation of contaminated moisture in cooled parts of the 
electronic equipment. 

The crew bay atmosphere will generally be oxygen rich 
and may contain excessive moisture contaminated with 
human excretion. 

7.1.10 Inability of electronic equipment to maintain undisturbed 
operation in the presence of transient supply voltage 
pulses shorter than the response time of power system 
regulators. 

7.1.11 Power system surges outside tolerable limits resulting from 
equipment turn-on or off. 
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7.1.12 Electrical wiring in contact with fluid lines. 

A short circuit from a hot wire to a grounded fluid 
line can burn a hole in the line and cause a leak, a 
gross line rupture, or a fire, depending on the 
pressure and the type of fluid in the line. 

This same hazard exists in the case of fluid tanks. 

7.1.13 Lack of protection from damage or corrosion caused by 
electrolyte leakage or improper venting from batteries. 

7.1.14 System design that does not provide a means of verifying 

in preflight tests that each individual path in a redundant 
system is operational. 

7.1.15 Short or open circuits in biomedical or communications 
wiring inside pressure suit. 

7.1.16 Electrical shock through biomedical or communicatiotiS 
wiring. 

7.1.17 Electrical energy sources or storage devices (batteries, 
capacitors; Inside the pressure suit. 

7.1.18 Solder joint cracking in potted printed circuit board 
assemblies, including cordwood modules. 

7.1.19 Wiring unprotected from damage due to traffic in the crew 
bay during preflight preparations. 

7.1.20 Excessive use of carry-on checkout equipment and need to 
disconnect vehicle cables for checkout. 

7.1.21 Switching of latching relays caused by transients to an 
unplanned configuration. 

7.1.22 Interference of attitude control jets with optical star 
trackers by: 

a. Solar reflection from particles or crystals in jet 
efflux. 

b. Displacement of star image by refraction of light in 
jet efflux. 

c. Corona induced by ionized jet gas impinging on 
unpressurized electronics of star tracker. 
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7.1.23 Equipment not designed to survive momentary power 
interruptions. 

7.1.24 Lack of protection for pyrotechnic circuits from transients 
generated in the space vehicle electrical power system. 

7.1.25 Shared firing control circuitry that requires critical 
systems to be armed during periods when they are not to 
be used, i.e., while the firing control circuitry is 
energized to fire other systems. 

7.1.26 Failure to remove shorting devices such as springs and clips 
used in connectors, prior to connector use. 

7.1.27 Inadequate marking of mating plugs and wires to indicate 
correct mating connections or termination points. 

7.1.28 Failure to use female connectors at sources of power. 

7.1.29 Solid wire (single strand) used in locations where it may 
be subjected to flexing. 

7.1.30 Electrical connector and cable installations with 
insufficient flexibility, length, and accessibility to 
permit disconnection and reconnection without damage to 
wiring or connectors. 

7.1.31 Failure to ground or insulate control shafts, knobs, 
handles, or levers to preclude personnel shock or burn. 

7.1.32 Power circuits and signal circuits routed through the same 
connector causing electromagnetic interference. 

7.1.33 Failure to remove electrical power from electrical 
connectors during engagement/disengagement operations. 

7.1.34 Failure to hermetically seal relays, including motor 
start relays, level sensing devices, switches, cam 
contacts, commutators, etc., which can produce an 
electrical arc. 

7.1.35 Lack of consideration for potential corona discharge in 
high voltage or high frequency circuits. 

7.1.36 Presence of contaminants or offgassing materials from motor 
switches, relays, etc. 
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7.1.37 Failure to passivate solid state devices. 

7.1.38 Engine kill circuitry live after holddown release. 

7.1.39 Failure to deadface or otherwise protect against shorts in 
circuits interrupted by guillotine cutters. 

7.1.40 Inadequate requirements for redundant relays in critical 
ci rcui ts . 

7.1.41 Paralleling relay contacts without protecting against, 
or eliminating, the possibility that one set of contacts 
may mate in the new position before the other set has 
broken from the old position. 

7.1.42 Lack of provisions for bleeder resistors to discharge 
capacitors when equipmant is deenergized. 

7.1.43 Inadequate means of isolating instrumentation circuitry 
from operating system circuitry. 

7.1.44 Improper isolation of primary and redundant system circuits. 

7.1.45 Lack of protection against inadvertent operation of circuit 
breakers or switches used to control pyrotechnic devices 
and other circuitry intended for emergency purposes. 

7.1.46 Failure of the built-in test equipment to fail safe. 

7.1.47 Improper protection of critical circuits from electrical 
short circuits at connectors. 

7.1.48 Internal shorts, overheating, and explosion of batteries. 

7.1.49 Inability of batteries to accept multiple recharges without 
dendrite growth and internal shorts. 

7.1.50 Improper thermal isolation between batteries. 

7.1.51 Inadequate provisions for battery heat dissipation. 

7.1.52 Failure to provide all hermetically sealed batteries 
with blowout plugs for pressure relief. 
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7.1.53 

7.1.54 

7.1.55 

7.2 

7.2.1 

7.2.2 

7.2.3 

7.2.4 

7.2.5 

7.2.6 

7.2.7 

7.2.8 


Ejection of battery electrolyte from batteries. 

Batteries vented into the habitable areas of the spacecraft 
without adequate atmospheric mixing. 

The existence of unintended electrical current paths (Sneak 
Circuits) which may lead to unplanned system activation witit 
a hidden cause and effect relationship. 

FABRICATION 

Ultrasonic cleaning of assembled circuit boards containing 
transistors. 

Internal parts of some transistors are subject to 
resonant response and fatigue damage at some 
frequencies used in ultrasonic cleaners. 

Soldering of electronic parts to circuit boards in 
cordwood modules prior to potting between the circuit 
boards . 

Expansion and contraction of potting during cure can 
damage solder connections. 

Stresses on glass diodes from excessive conformal coating. 

Use of long screws that penetrate black boxes and damage 
internal wiring or components. 

Inadequate stress relief of soldered connections. 

Physical separation and support of uninsulated wires or 
electronic parts in components not sufficient to ensure 
against contact under sustained gravity force, vibration, 
or structural distortion. 

Use of swaged eyelets (without soldering or welding) to 
form an electrical connection between conductors. 

Polystyrene parts on circuit boards that are to be coated with 
polyurethane conformal coatings. 


The solvents used in polyurethane conformal coatings 
may attack and dissolve polystyrene parts. 



7-6 


7.2.9 Application of excessive torque during installation of 
stud-mounted semiconductors. 

Some stud-mounted semiconductors will tolerate only 
very low installation torques (on the order of 10 
inch-ounces) without risk of hermetic seal failure. 

7.3 TOXICITY 

7.3.1 Polyvinyl chloride used as wire insulation. 

7.4 FLAMMABILITY 

7.4.1 The use of organic pigments in Teflon wire insulation. 

The addition of some organic pigments will make Teflon 
insulation burn in environments where it would normally 
be nonflammable. 

7.4.2 Inadequate separation of electrical and heat producing components 
from oxygen systems. 

7.4.3 Use of ethylene glycol not inhibited with Benzotriazole in 
proximity to electrical circuitry containing silver or silver- 
coated copper. 

7.5 CORROSION 

7.5.1 Use of sulphur-containing or sulphur-coated materials in close 

proximity to electrical contacts. 

7.5.2 Use of "Locktite" in applications where it can come in contact 
with magnetic tape. 

"Locktite" contains chemicals which damage the iron 
oxide coating of magnetic tape. 

7.5.3 Ingestion of moisture and salts from ambient atmosphere 

Into unsealed components cooled to cryogenic temperatures. 

Cooling of components to very low temperatures reduces 
internal pressure and may cause external air to be 
drawn in if the component is not hermetically sealed. 

This breathing action has caused internal contamination 
and corrosion of electrical equipment in seacoast 
atmospheres . 
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7.5.4 Galvanic corrosion products creating a conducting path 

between normally open switch contacts. Switch contacts not 
adequately protected from exposure to moisture or moist 
air. 

7.6 VIBRATION 

7.6.1 Failure of relays, qualified under launch and boost 
conditions, to operate under quiescent conditions (e.g., 
during vehicle coast) due to friction introduced to prevent 
Inadvertent actuation by vibration. 

7.6.2 Improper operation of relays during vibration as a result of: 

a. Changes In mounting configuration subsequent to 
qualification tests. 

b. Failure to orient sensitive axis to minimize effects of 
vibratl on. 

c. Failure to orient redundant relays along orthogonal axes. 

7.6.3 Use of relays, switches, circuit breakers, or other current 
Interrupting devices which are not qualified for local 
environmental conditions resulting from strucutral or acoustic 
shock generated by firing of pyrotechnic devices. 

These shocks have been known to cause fracture 
of the “lead to chip" bonds In transistors. Shock 
spectrums peaking as high as 8500 g's at 8000 hertz 
have been noted. 

7.7 DEFECTIVE OR UNSUITABLE EQUIPMENT 

7.7.1 Improper application or Inadequate screening nf wet slug 

tantalum capacitors. 

These capacitors have a tendency to discharge 
prematurely on the first cycle after a long stand 
period. This characteristic makes them unsuitable 
for time-delay devices where early timeout would be 
undesirable. 

They are generally very sensitive to polarity reversal. 

As little as 0.5 coulomb of charge moving In the 
reverse direction may produce sufficient electroplating 
of silver onto the anode to degrade performance. 


< 


* 
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They are prone to progressive electrolytic leakage 
through seals which is particularly difficult to 
detect in the incipient stage. 

7.7.2 Inadvertent use of counterfeit electronic parts. 

7.7.3 Solder balls or weld splash in transistors and relays. 

7.7.4 Solder balls or wire whiskers larger than the gap between 
contacts in normally open momentary- con tact switches. 

The risk of inadvertent circuit actuation is greatest 
under zerogravity or vibratory conditions. 

The risk of electrical field attraction of large single 
solder balls or grtups of small solder balls to contact 
points under zerogravity conditions is undetermined. 

7.7.5 Insufficient clearance between moving switch contacts and 
a grounded switch case or switch-operating mechanism. 

Elastic overshoot of the contact following switch 
toggle actuation to open the circuit, or motion of the 
contact due to vibration or physical shock, can cause 
..^mentary short circuiting of the contact to ground. 

This type of very short duration circuit is difficult 
to detect during regular spacecraft checkout tests. 

7.8 PROTECTION FROM ENVIRONMENT 

7.8.1 Corona and arcing due to: 

a. Leakage of sealed pressurized components. 

b. Inadvertent premature turn-on of equipment. 

c. Outgassing more prolonged than anticipated. 

7.8.2 Structural failure of spacecraft containers during changes in 
atmospheric pressure. 

7.8.3 Insufficient protection against harmful environmental (salt 
water) intrusions into electrical systems and power supplies 
used for postlanding survival and recovery. 
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7.8.4 Water intrusion into electrical connectors from: 

a. Nighttime condensation. 

b. Cooling of connectors inside a space vehicle to 
temperatures below the dewpoint of the interior 
atmosphere as a result of heat conduction through 
copper cables extending to a colder environment 
outside the vehicle. 

7.8.5 Improper protection of magnetic latching valves from 
degradation of latching force by contaminants carried to the 
pole faces by internal fluid flow. 

7.8.6 High resistance coating deposited on electrical contacts 
from outgassed products of potting compound as a result of 
elevated temperatures or low pressures. 

7.8.7 Decrease of moist environment insulation resistance in 
electrical components after coating with "Ladicote" for 
flammability protection. 

7.8.8 Arrangement of leads or electronic parts which does not 
provide relief of strain caused by thermal expansion and 
contraction. 

7.8.9 Resistance changes in metal film resistors caused by 
electrostatic fields. 

Resistance changes up to 6 percent were measured on 
precision resistors that had been shipped loosely 
packed in plastic envelopes. Similar resistance 
changes have been produced by subjecting new resistors 
to electrostatic fields of 50,000 volts for 30 seconds. 
Other characteristics of the resistors were unaffected. 

Susceptibility of electronic items other than thin 
film resistors to damage by similar electrostatic 
fields is undetermined. 

7.8.10 Inadequate protection of system from the effects of 
lightning. 

7.9 OPERATIONAL STATUS INFORMATION 

7.9.1 Improper rotational speed of guidance system gyros at 

launch vehicle lift-off or start of spacecraft engine 
in orbit. 
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7.9.2 Powering-up systems with latching relays in unknown 
positions. 

7.9.3 Meters or measurement systems supplying critical operating 
information that can fail without giving an immediate 
indication that a failure has occurred. 

7.9.4 Capability to provide conflicting commands from ground 

and flight control. 

7-10 OVERLOADS 

7.10.1 Circuit b»'eakers too la«^ge or too slow-acting to protect 
wiring. 

7.10.2 Flammable potting in electrical connectors. 

7.10.3 Circuit breakers and switches with flammable cases or 
operating parts, used in an o;ygen-enri ched environment. 

7.10.4 Contacts and pins in electrical circuits that will fuse 

or weld within the current/time limits permitted by current 
limiting or circuit protection devices. 

7.10.5 Failure to provide current overload devices for current 

carrying conductors connected to flight hardware. 

7.10.6 ‘-ailure of circuit breakers to trip and protect the 
circuit. 
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8.0 FLUID HAZARDS 

8.1 CONFIGURATION 

8.1.1 Freezing of fluid lines inadequately protected from cryogenic 
fluids or exposure to space. 

8.1.2 Reverse installation of fluid line components (such as check 
valves) whose proper functioning is dependent on direction 
of flow. 

8.1.3 Inability to remove dangerous fluids remotely and rapidly 
from the vehicle during emergency back-out from a planned 
operation. 

8.1.4 Inadequate provisions for maintaining separation of coolant 

and electrical components in coolant pumps. 

8.1.5 Inadequate protection cf pressure-sensitive components 

against damage from interruption or fluctuations of supply 
pressure. 

8.1.6 Lack of a positive means of assuring that removal of 
propellant loading lines will not result in backflow of 
propellant through the fill port. 

8.1.7 Systems or operations that cannot survive should a single 
valve fail to open or close on command. 

8.1.8 Location of drain valves at other than low points in fluid 
systems. 

8.1.9 Undesired spacecraft motions resulting from directional 
venting of onboard gas or liquid. 

8.1.10 Loss of system operating fluid through leakage or rupture of 
a transducer sensing element. 

8.1.11 Propellant tanks containing toxic fluids mounted where they 
are vulnerable to crushing during landing impact. 

8.1.12 Soft-seat hand valves upstream of regulators or other 
contamination sensitive components in fluid systems. 

8.1.13 Tank fill ports not accessible from outside the vehicle. 
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8.1.14 

8.1.15 

8.1.16 

8.1.17 

8.1.18 


8.1.19 

8.1.20 


Inadequate provisions for containment and removal of 
dangerous fluids released in spills, leaks, or sprays 
occurring at vehicle tank fill ports. 

Valve configurations that will release propellants or 
other damaging fluids into unprepared areas if the 
electrical power or gas pressure supplied to the valves 
is interrupted. 

Even when the fluid does not escape into unprepared 
areas, rapid unplanned and uncontrolled dumping can 
be hazardous since the ullage gas flow rate may be 
insufficient to prevent tank implosion under 
atmospheric pressure. 

Cryogenic helium-to-fuel heat exchangers that can freeze 
after engine shutdown occurs leaving fUv’l trapped in lines 
between heat exchanger and engine valves. 

Manually operated shutoff valves that can be rendered 
inaccessible by a downstream line rupture. 

Eccentrically pivoted butterfly valves separated from 
pressurized liquid in a tank or line by a gas trap. 

When the valve starts to open the gas flows very 
rapidly through the partially opened valve. The 
liquid following the gas is accelerated to high 
velocity and may reach the butterfly long before it 
's fully opened. If the butterfly is eccentrically 
pivoted to utilize liquid pressure as an aid to 
closing it or holding it closed, the impinging high 
velocity liquid stream can slam it closed and generate 
water-hammer forces capable of rupturing the piping. 

The situation is compounded if the liquid is 
cryogenic. The rapid reduction in pressure as the 
gas escapes through the valve and the relatively warm 
piping in the gas trap cause flash boiling and 
violent pressure surges in the liquid approaching the 
valve. 

Inadequate protection of lines against damage from mechanical 
stress and vibration. 

Fuel, oxidizer, and propellant lines routed through inhabited 
areas of the spacecraft. 
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8.1.21 

8.1.22 

8 . 1.23 

8 . 1.24 

8 . 1.25 

8.2 

8 . 2.1 

8 . 2.2 

8 . 2.3 

8 . 2.4 

8 . 2.5 

8.3 

8 . 3.1 

8 . 3.2 

8 . 3.3 


Relief ports and vent lines located where escaping liquids 
or gases will be hazardous to personnel or equipment 
during flight or ground operations. 

Shutoff valves installed in series with relief valves 
without another positive relief device installed in 
parallel. 

Manually operated valves used to bypass pressure regulators 
or flow control devices. 

System connectors not keyed or sized so that it is 
impossible to connect incompatible gases, fluids, or 
pressure levels. 

Fluid systems with inadequate provisions fcr shutting off 
flow to sections of the system which ar_ susceptible to 
damage or leakage. 

FABRICATION 

Failure of brazed joints due to inadequate control of the 
brazing process. 

Failure to make radiographic inspections of pressure 
vessels after proof tests. 

Failure/leakage of "B" nuts due to improper installation. 

Use of dye penetrant not liquid oxygen compatible in 
checking liquid oxygen system valves. 

Fluid systems packings should be compatible with the system 
fluid, even when used as secondary seals. On a Skylab 
Mission, butyl rubber secondary seals leaked when contacted 
by nitrogen tetroxide after failure of the metal- to-metal 
primary seal. 

CONTAMINATION 

Orifices, close tolerance valves and contamination-sensitive 
equipment in fluid systems not adequately protected by 
filters. 

Contamination of spacecraft fluid systems due to inadequate 
analysis and filtering of fluids immediately prior to 
loading into spacecraft. 

Contamination introduced by momentary reversal of flow 
(e.g,, during chamber pressure surge in a hard start of 
an engine) with no filter downstream of a device sensitive 
to contamination. 
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8 . 3.4 

8 . 3.5 

8.4 

8 . 4.1 

8 . 4.2 

8.5 

8 . 5.1 

8 . 5.2 

8 . 5.3 

8 . 5.4 

8 . 5.5 

8 . 5.6 

8 . 5.7 


Lack of recognition that orbital operation of fluid systems 
imposes increased demands on filters to dispose of debris 
that in ground operations is normally separated out and 
held in sumps by gravitational forces. 

Inadequate protection of plumbing systems from introduction 
of contamination when opened for repairs or replacement of 
components . 

Especially critical vdien the system is opened between 
a contamination sensitive element and its protective 
filter. 

TOXICITY 

Circulation or storage of toxic fluids within the crew 
bay. 

Bacterial transfer from waste water system to drinking 
water. 

The use of conventional valves to separate waste 
and potable water systems does not provide adequate 
insurance against bacterial migration into the 
drinking water. 

FLAMMABILITY 

Exposure of titanium to liquid oxygen or high pressure 
gaseous oxygen. 

Use of solder joints and aluminum tubing in spacecraft 
oj^gen lines. 

Use of incompatible materials in liquid or high-pressure 
gaseous oxygen systems. 

Static charge generation in flowing fluid systems. 

Presence of ignitic.i sources in the vicinity of propellant 
system vents. 

Inadvertent interchange of identical fuel and oxidizer 
components without appropriate cleaning. 

Explosive reaction of ethylene glycol on contact with 
nitrogen tetroxide. 



8-5 


8.5.8 

8.5.9 


8.5.10 

8.6 

8.6.1 


8.6.2 

8.6.3 

8.6.4 

8.6.5 

8.6.6 

8.7 

8.7.1 

8.7.2 


Use of hot-wire sensors in hydrogen system. 

Nylon seats in ball valves used in hiqh pressure (1800 
to 4000 pounds per square inch, gauge) systems. 

Such devices have been found to burn in air systems 
at temperatures developed by compression of air. 

Use of flammable fluids as cooling agents. 

CORROSION 

Inadequate removal of lubricating fluid used in the 
drawing process from AlSl 316 stainless steel tubing 
prior to annealing. 

During annealing, carbon in the fluid stimulates 
formation of cartides rich in chromium. This 
process depletes the chromium in the adjacent metal 
to the point where intergranular corrosion occurs. 

Inadequate removal of pickling acid used to clean tubing 
after annealing. 

The remaining acid attacks the metal and may cause 
intergranular corrosion during storage of the tubing 
prior to use. 

Corrosion in potable water systems due to chlorine used 
for v/ater sterilization. 

Chemical reaction between cooling fluids and materials 
used to contain and control the flow of the fluid within 
the cooling system. 

Reduction in strength of titanium resulting from exposure 
to fluids not verified to be free from adverse stress 
corrosion effects on titanium. 

Titanium exposed to hydraulic fluids at temperatures above 
300-degrees Fahrenheit is subject to hydrogen embrittlement 

OPERATIONAL STATUS INFORMATION 

Premature depletion of propulsion or attitude control 
capability not detected by propellant gaging system. 

Gas temperature control sensors located in a gas stream 
carrying condensed liquid droplets at zerogravity. 
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8.7.3 

8.7.4 

8.7.5 

8.8 
8.8 1 

8.8.2 

8.8.3 

8.8.4 

8.8.5 

8.8.6 

8.8.7 


The flow pattern of the liquid, and hence the 
evaporative cooling of the sensor may differ 
significantly from that established In qualification 
tests or calibrations at one gravity. 

Limited life/limited cycle Items which require periodic 
actions such as inspection, recharge, replacement, etc., 
not Identified on tracking and action I'sts. 

Limited life/limited cycle items Installed so that time 
action cannot be accomplished. 

Lack of stringent procedures for monitoring limited life/ 
limited cycle sensitive equipment. 

PRESSURE CONTROL 

Pressure relief valves and flow limiting devices not sized 
to protect against a failed-open regulator. 

Pressure drop in ducting downstream of pressure relief 
valves. 

Lack of adequate pressure relief capability in sections of 
plumbing where cryogenics or hydrogen peroxide can be 
trapped. 

Differential pressure gages without pressure relief provisions 
to prevent case rupture if high and low pressure connections 
are inadvertently reversed. 

The hazard is greatest when high and low pressure 
connections are identical in size and type of thread. 

Unvented enclosures containing pressure sources or lines 
that could, through leakage, build up internal pressure in 
the enclosure. 

Bends in exhaust lines downstream of pressure relief vents 
In high pressure systems. 

Bends tend to straighten on venting. 

Regulator shutoff valves not qualified for extremes of 
temperature that can be reached as a consequence of the 
flow through a failed-open regulator. 
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8.8.8 

8.8.9 

8.9 

8.9.1 

8.9.2 


Failure to limit pressurant gas flow rate to the maximum 
required under worst case operating conditions. 

Overpressurization of spacecraft systems by ground support 
equipment not provided with adequate pressure limiting or 
pressure relief devices. 

LEAKAGE 

Inadequate protection against damage from leaks or spills 
incident to the loading of fluids aboard the vehicle. 

Seal and 0-ring leakage due to aging or cold flow. 
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9.0 PROPULSION HAZARDS 

9.1 CONFIGURATION 

9.1.1 Engine hard start (transient overpressure) due to fuel lead 
(early injection of fuel relative to oxidizer). 

9.1.2 Hypergolic propellants separated by a single weld. 

9.1.3 Inadequate protection of propellant valves from damage by 
heat soak-back from the thrust chambers. 

9.1.4 Metal -to-metal rubbing in liquid oxygen pumps. 

9.1.5 Combustion instability in rocket engines. 

9.2 CONTAMINATION 

9.2.1 Clogging of nitrogen tetroxide injector feedlines in 

attitude control engines caused by nitric acid formed 
after exposure to atmospheric humidity in preflight 
ground firings. 

9.2.2 Engine explosion due to alcohol flush contamination of 

hypergolic propellants. 
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10.0 EXPLOSIVE HAZARDS 

10.1 CONFIGURATION 

10.1.1 Improper routing, handling, support, and terminating of 
explosive trains. 

10.1.2 Inadequate protection of power supplies from short circuits 

in fired pyrotechnic devices. 

10.1.3 Failure to design and pack parachute reefing line cutters 
properly to withstand snatch loads imposed by lanyards. 

10.1.4 Lack of protective devices on the hot side of individual 
pyrotechnic devices to ensure firing of other pyrotechnics 
that are in parallel with one whose hot side shorts to ground 
after firing. 

10.1.5 Insufficient or unsatisfactory redundancy in hot bridge 

wire pyrotechnic initiators. 

Initiators with dual bridge wires have been found to 
be sensitive to differential to electrical potential 
between the bridgewires. 

10.1.6 Explosive charge in guillotine and tension tie cutters 
insufficient to sever wire bundle. 

Charge requirements are sensitive to bundle position 
and have been found to be significantly greater when 
the bundle is pulled against the blade than when it 
is lying flat on the anvil. 

10.1.7 Hygroscopic materials in close proximity to explosives or 
firing circuits. 

10.1.8 Pyrotechnic devices not adequately designed to contain 
fragments and blast from the explosion. 

10.1.9 Damage to one leg of an explosive train by blast from an 
adjacent redundant let initiated simultaneously but 
propagating more rapidly. 

10.1.10 Ignition through the nozzle of multiple solid propellant 
rocket systems that may permit the blast from the first 
rocket ignited to destroy wiring and prevent sufficient 
electrical firing energy from reaching the remaining 
rockets . 



10.1.11 

10.1.12 

10.1.13 

10.1.14 

10.1.15 

10.2 

10.2.1 

10 . 2.2 

10.2.3 


10.2.4 


10-2 

Deformation of shaped charge liners caused by pressure from 
off gassing of explosive core materials. 

Degradation of lead jacket on explosive trains caused by 
incompatibility with bonding agents, solvents, or volatiles 
released during curing. 

Desensitization of explosive materials by residuals of solvents 
used in cleaning operations. 

Inability to disarm propellant dispersion (destruct) systems 
after they have served their purpose, on stages or modules 
that are to remain in close proximity to the spacecraft or 
which will be recovered for future use or which may terminate 
their flight in an inhabited area. 

Explosives made more sensitive by chemical reactions between 
explosives and their containers. (Lead azide + water + silver 
or copper charge holder = extremely sensitive silver or copper 
azide.) 

VERIFICATION OF EQUIPMENT 

Incomplete identification, manufacturing and storage 
history, and description of pyrotechnic devices. 

Pyrotechnic devices not verified by neutron radiograph 
inspection and/or X-ray to have proper placement and density 
of explosive materials and piece parts. 

Lack of provisions for conspicuous identification by color 
code of all pyrotechnic units not intended for flight 
use. 


Units in this category include inert units, rejected 
flight operational units, and special purpose 
units such as nonstandard charge units, test and 
development units, simulators, and charged training 
uni ts . 

Uncontrolled or insufficiently verified test techniques 
used to demonstrate insensitivity of pyrotechnic devices 
to initiation by static charges. 

By creating a conducting or low resistance path 
through the explosive mix, these tests can permanently 
lower the resistance of the device to initiation by 
subsequent static charges. 
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10.3 HANDLING OF EQUIPMENT 

10.3.1 Failure of packaging, shipping, and storage provisions to 

protect pyrotechnics from static charges, impact and shock, 
high and low temperatures, moisture, and contamination. 

10.3.2 Pyrotechnic circuit checks with electrical test equipment 

using, or containing, power sources high enough to fire 
electroexplosive devices. 

10.4 PROTECTION FROM ENVIRONMENT 

10.4.1 Failure of pyrotechnic devices due to sublimation of 
explosives not adequately sealed from space vacuum. 

10.4.2 Inadequate protection of solic propellant rocket motors from 
moisture or other contaminants by seals capable of: 

a. Maintaining an internal atmosphere of dry nitrogen at 
pressures above ambient. 

b. Being expelled during normal rocket ignition without 
damage to the nozzle and without leaving remnants that 
could alter the normal flow through the nozzle. 

c. Providing access for inspection of the grain (if other 
suitable provisions do not exist). 

10.4.3 Inadequate protection of ends of shaped charges and primacord 
from intrusion of moisture or expulsion of explosive material 
during vibration and decompression. 
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11.0 

11.1 

11.1.1 


AERODYNAMIC HAZARDS 
CONFIGURATION 

Spacecraft aerodynamic shapes having stable attitudes that 
are unsafe for reentry or parachute deployment. 
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12.0 OPERATIONAL HAZARDS 

12.1 CONFIGURATION 

12.1.1 Inadequate procedures to ensure removal of all nonflight 
equipment prior to flight. 

12.1.2 Allowing primary attitude indicators to be switched to 

display other than basic flight parameters without adequate 

cautions. 

12.1.3 Failure to maintain required pressure in a system because 
of a common pressure source which is required to supply 
several demands simultaneously. 

12.1.4 Implosion of liquid tanks as a result of inadequate inflow 
of ullage gas as liquid is drained under atmospheric 
pressure . 

12.1.5 Inadequate provisions for controlling or limiting temperature 
change in tanks or pressure bottles during pressurization. 

12.1.6 Unreported design or manufacturing changes made in production 
components after qualification tests. 

12.1.7 Inadequate locking and securing of electrical connectors 
and mechanical fasteners. 

12.1.8 Lack of protection from air intrusion into purge hydrogen 
systems. 

12.1.9 Inadequate bonding and grounding of equipment, plumbing, and 
facilities used with liquid hydrogen. 

12.1.10 Lack of explosive vapor detection capability in the vicinity 
of propellant handling operations. 

12.1.11 Failure to install positive leak-preventing caps or plugs 
on fill and test ports prior to flight. 

12.1.12 Lack of a single authoritative source of up-to-date 
information on the actual configuration existing in the 
stages and interfaces of the vehicle at any time. 

12.1.13 High pressure or flammable fluid lines in the vicinity of 
welding operations. 
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12.1.14 

12.1.15 

12.1.16 

12.1.17 

12.1.18 

12.1.19 

12.2 

12.2.1 

12.2.2 

12.2.3 

12.2.4 

12.3 

12.3.1 

12.4 

12.4.1 


Lack of distinctive identification on otherwise identical 
switches on the same panel when incorrect switch selection 
would create a dangerous situation. 

Lack of separate fluid servicing capability for each module 
of the space vehicle. 

Inadequate provisions for verification of crew visibility 
required on manned spacecraft missions. 

Failure to evaluate crew safety impact of changes to baseline 
configurations (philosophy, hardware, and operations). 

Inaccessibility of emergency equipment (e.g., fire 
extinguisher and oxygen masks) under all identifiable 
contingencies. 

Lack of guards for switches that control critical functions. 
CONTAMINATION 

Inadequate protection of breathing oxygen systems from 
contamination. 

Lack of procedures to verify removal of all tools and 
extraneous equipment prior to closeout for shipment or 
start of tests. 

Circulation of ground fluids (coolants, etc.) through space 
vehicle systems. 

Exposes the flight systems to contamination existing 
or generated in ground support equipment. 

Fogging of spacecraft windows by silicone oil from room- 
temperature vulcanized compounds not heat cured in vacuum 
before flight. 

TOXICITY 

Inadequate method for the control of radioactive materials 
which may be inadvertently released in spacecraft modules. 

HUMAN ERROR 

Reduced work force competence and ill-considered 
improvisations that characterize tightly scheduled, multiple 
shift operations. 
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12.4.2 

12.4.3 

12.4.4 

12.4.5 

12.4.6 

12.4.7 

12.4.8 

12.4.9 

12.4.10 

12.5 

12.5.1 

12.5.2 

12.5.3 


Insufficient technical review of planned test procedures, 
including changes and deviations generated during tests. 

Simultaneous tests on the same vehicle controlled by 
different groups not adequately coordinated. 

Inadequate protection of pressure vessels and pressure lines 
from damage by dropped tools, slipping wrenches, drills, or 
incorrect sized bolts and screws. 

Failure to remove covers or seals from overboard dump ports, 
pitot and static pressure sensing ports, and pressure 
relief vents. 

Inadequate provisions for exchange of technical information 
between shifts performing a continuing test. 

Insufficient planning and operator training and rehearsal 
for foreseeable emergencies. 

Docking without deactivating incompatible vehicle 
stabilization systems. 

The change in vehicle mass or differences in 
stabilization system response characteristics in 
the two vehicles can cause severe oscillations 
with excessive waste of control system propellants. 

Overloading of spacecraft on Doard computer by failure to 
remove inputs not being used. 

Failure to follow procedures rigorously that require a 
callout of functions to be performed and an affirmative 
response that each function has been accomplished. 

IMPROPER PROCEDURES 

Unnecessarily early arming of systems. 

Mating and demating of electrical connectors without 
removing voltages from the powered side(s) of the connector, 
where the connector has not been specifically designed to 
tolerate this type of operation. 

Unrecognized damage to flight hardware resulting from prior 
use in training exercises. 
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12.5.4 Failure to verify compatibility of electrical inputs from 
ground equipment to spacecraft system immediately prior to 
connecting for tests. 

12.5.5 Unnecessary delay in disarming systems no longer needed. 

12.5.6 Inadequate provisions for obtaining and verifying 
equalization of internal and external pressures prior to 
opening of hatches or pressure systems. 

12.5.7 Check valves with soft seats subjected to higher than 
design pressure differentials during testing. 

12.5.8 Spontaneous ignition of “Pastra-Jell" and aluminum wool 
used in cleaning. 

12.5.9 Use of nonconducti ve plastic coverings over spacecraft or 
equipment containing pyrotechnic devices. 

12.5.10 Using metal tools to troubleshoot powered-up electronic 
equipment. 

12.5.11 Failure to maintain an inert gas blanket over propellants 
in tanks. 

12.5.12 Failure to purge liquid hydrogen systems with gaseous 
helium prior to introduction of liquid hydrogen. 

12.5.13 Failure to relieve pressure completely to an accurately 
measured level low enough to prevent dangerous motions or 
sprays when systems are opened. 

12.5.14 Use of halogenated hydrocarbon solvents to clean nitrogen 
tetrox’de systems (e.g., Tri chore thy lene cleaning fluid). 

12.5.15 Failure to verify operational readiness of safety systems. 

12.5.16 Failure to obtain a final end-to-end check of space 
vehicle control and stabilization systems in the launch 
configuration. 

12.5.17 Overstressing of flight articles in testing. Failure to 
verify safety of a planned test on a flight article by 
prior tests on a prototype. 
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12.5.18 

12.5.19 

12.5.20 

12.5.21 

12.5.22 


12.5.23 

12.5.24 

12.5.25 

12.5.26 

12.5.27 

12.5.28 


Failure to require a detailed reverification of circuit 
and component condition after an inadvertent overvoltage, 
polarity reversal or connector disconnect. 

Overheating of solenoid valves in ground tests (dry). 

Uncalibrated pressure relief devices. 

Failure to maintain historical records of electrical 
signature tests on critical solenoid valves. 

Propellant loading procedures that permit periods of time 
when propellant in the spacecraft propellant tanks is under 
greater pressure than that existing in the spacecraft gas 
manifold system. 

Even though system leak checks are made prior to 
loading, there is a possibility of propellant leakage 
into the spacecraft plumbing. When the pressurization 
system is activated in flight the leaked propellant 
can freeze and interfere with operation of the 
pressurization system or can be forced into the 
opposite propellant tanks, when oxidizer and fuel 
tanks have a cotranon pressurization system. 

Working on live electrical equipment near pressure lines 
or tanks containing hazardous fluids or high pressures. 

A short circuit from hot wires through metal tools 
to grounded pressure lines or tanks can cause rupture 
and ignition of fluid sprays. 

Entering tanks or confined spaces without protective 
equipment and procedures. 

Excessive or uncontrolled cycling or operation of limited 
life/cycle flight hardware v/hich could cause inflight 
failure because of wear-out. 

Lack of rigorous housekeeping procedures which prevent 
accumulation of flammable materials outside stowage 
contai ners. 

Use of malfunction procedures which place crewmen in an 
unsafe posture. 

Crew timelines which do not provide adequate time to 
accomplish an operation or series of activities. 
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12.5.29 

12.5.30 


12.6 

12 . 6.1 

12.7 

12.7.1 

12.7.2 


Inadequate requirements and procedures for retesting 
systems after changes. 

Failure to provide rapid response postflight safing team, 
under a single activities manager, consisting of: 

(1) Personnel with detailed system knowledge, an 
understanding of safety requirements, and capable of 
making sound, on-the-spot, decisions. 

(2) Detailed, preplanned procedures for accomplishing 
both nominal and contingency postflight safing. 

(3) A full complement of operational and protective 6SE 
for preforming nominal and contingency safing 
operations. 

HANDLING OF EQUIPMENT 

Inadequate procedures for handling and transferring 
hazardous fluids or materials in a pressurized area. 

OPERATIONAL STATUS INFORMATION 

Failure to provide an equipment operator with an immediate 
and positive indication of system response to his control 
actions. 

Means not provided to verify the integrity of a docking 
hatch seal before separating a docked module or vehicle. 



